Understanding Domain and IP Reputation in Email Deliverability

If you’re in the legal field, you’re well acquainted with the ways in which a good (or bad!) reputation can have an enormous impact on your practice’s success. Email deliverability is no different; mailbox providers (MBPs) use a variety of factors to determine what kind of reputation should be associated with your emails. Let’s break it down:

IP Reputation

An IP address is like a home address for your computer on the internet or local network, ensuring data sent from your computer reaches the correct destination and that data sent to you arrives at your computer.

When it comes to email, the IP address from which it originates is not just a technical detail—it carries a distinct reputation with it, much like a credit score. Just as lenders use credit scores to gauge the financial reliability of a person, MBPs evaluate an IP’s history to determine its trustworthiness. This reputation is shaped by different variables including:

  • Email volume and its consistency (or lack thereof)
  • Frequency of those emails being marked as spam
  • Bounce rates

If an IP address consistently sends out high-quality, relevant emails that recipients engage with, it’s much more likely to enjoy a positive reputation. On the flip side, its reputation can quickly plummet if it becomes associated with behaviors such as:

  • Sending large quantities of unsolicited email
  • High bounce rates
  • High frequency of spam complaints

A damaged IP reputation can have significant consequences that lead Email Service Providers (ESPs) to filter or block emails from that IP. This affects the sender’s ability to reach their intended audience effectively.

Domain Reputation

domain, often recognized as a website or the web address, is a unique name that identifies a website or email address on the internet.

Every domain that sends email carries its own reputation, akin to a business’s standing in the community. This reputation is shaped by various behaviors and practices associated with the email you send:

  • Engagement
    • Mailbox providers want to see that your subscribers are engaged
    • They rely on hundreds of different signals to filter email, but engagement is heavily weighted.
    • Any time your subscribers show strong interest or engagement in your content, it’s a big win for your overall deliverability
  • Permission
    • Sending unsolicited email is a surefire way to harm your domain’s reputation
    • Unsolicited email is highly likely to result in spam complaints or even a spamtrap hit
    • Any domain associated with large numbers of spam complaints raises serious alarms for mailbox providers
  • Bounces
    • Large numbers of bounces can decrease trust in your domain
    • Because of this, it’s important to regularly curate and update your email lists Sending emails to old, unengaged, or invalid addresses often results in high bounce rates
    • List hygiene practices such as removing inactive subscribers or those who haven’t engaged in a long time are an effective preventative measure
  • History
    • Your domain’s email-sending history plays a significant role in its reputation
    • A consistent track record of sending high-quality, engaging emails can enhance your domain’s standing while any past transgressions, like sending to purchased lists or being flagged by spam traps, can linger and affect future deliverability
    • MBPs have a long memory, so it’s important to avoid these problems wherever possible
  • Authentication
    • Many inbox providers won’t accept your mail if it isn’t able to pass email authentication protocols like SPF (Sender Policy Framework) and DKIM (DomainKeys Identified Mail)
    • If you have a sending domain validated within Lawmatics, SPF and DKIM are automatically implemented when you add our CNAME records to your domain
    • However, if you remove or alter those records, there’s a good chance that authentication will fail and your mail will bounce
  • Blocklists
    • Having your domain listed on a blocklist can have a major effect on your deliverability
    • That being said, it’s worth noting that anyone can create a blocklist and not all of them are reputable or affect your email delivery

Ultimately, you and your firm play a major role in your domain’s reputation. Being mindful of the content you send, maintaining updated email lists, and engaging with your subscribers in a meaningful way aren’t just strategies to maintain a strong domain reputation; they’re essential steps to elevate your firm’s credibility. They also serve to enhance client engagement and secure consistent deliverability for your communications.

Article by Shay Paris of Lawmatics
For more articles on legal marketing, visit the NLR Law Office Management section.

Business Immigration Could Be Impacted if Congress Fails to Fund Government Through FY 2024

On September 30, 2023, President Joe Biden signed into law stopgap funding legislation that temporarily averted a government shutdown. The legislation, which passed the U.S. Congress with bipartisan support and extended funding for the federal government for a period of forty-five days, will keep the government running through November 17, 2023.

Quick Hits

  • A recently enacted stopgap funding measure has allowed the government to continue operations, including immigration services, through November 17, 2023.
  • If Congress cannot reach an agreement to fund the federal government before November 17, 2023, a partial government shutdown may occur.
  • A government shutdown would disrupt federal agencies that are responsible for immigration-related services and benefits. U.S. Citizenship and Immigration Services (USCIS) is a fee-generating agency; during past government shutdowns, USCIS offices generally continued to operate.
  • The U.S. Department of Labor (DOL) is not fee generating, and, consequently, the department’s operations were significantly hindered during previous government shutdowns. As a result, any immigration petition that requires a DOL pre-filing will likely be impacted.

The most significant business immigration impacts of a government shutdown on U.S. employers may include:

  • the DOL taking the Foreign Labor Application Gateway (FLAG) system offline, resulting in a suspension of new labor condition applications (LCAs) that are required for H-1B, H-1B1, and E-3 nonimmigrant petitions;
    • a DOL suspension of PERM labor certifications and prevailing wage determinations (PWD), which would further extend already lengthy PERM and PWD processing times; and
    • possible visa processing delays at U.S. consulates. While the U.S. Department of State is partially funded by visa application fees, it is possible that nonemergency services could be suspended during a prolonged shutdown.

Next Steps

While Congress temporarily averted a government shutdown, the members of the U.S. House of Representatives and the U.S. Senate have not reached an agreement on an appropriations bill to fund the federal government through the entirety of fiscal year (FY) 2024. The risk of a government shutdown remains if Congress is not able to resolve spending and policy disagreements prior to November 17, 2023.

For more articles on business immigration, visit the NLR Immigration section.

AI Versus Westlaw Copyright Bellwether Hurtles Toward Jury as Summary Judgment Largely Denied

In one of the first lawsuits to allege that generative AI companies violate the U.S. Copyright Act by using copyrighted works to train machine learning models, Judge Stephanos Bibas of the Delaware Circuit Court recently denied the majority of issues raised in cross motions for summary judgment filed by plaintiff Thomson Reuters and defendant Ross Intelligence Inc.  The court declined to issue a dispositive ruling on the hot-button question of whether the fair use doctrine protects generative AI companies that use copyrighted materials to train their programs.

Thomson Reuters (owner of Westlaw) sued Ross Intelligence, a legal-research generative AI startup, in May 2020, alleging that Ross was liable for both copyright infringement and tortious interference with contract.  The allegations against Ross stem from its endeavor to create a search engine that uses machine learning and artificial intelligence to provide answers to commonly asked legal questions.

In need of material to train its generative AI, Ross attempted to obtain a license to use Westlaw.  When Westlaw turned Ross away, it asked third-party legal research companies to provide it with legal material — much of which those legal research companies obtained from Westlaw.  Thomson Reuters contends that Ross copied large portions of Westlaw’s Headnotes and Key Number System.

After Ross’s motion to dismiss the copyright claim was denied in March of 2021, the parties each moved for summary judgment on a multitude of issues.  Most notably, Thomson Reuters moved for summary judgment on its copyright infringement claim, and both sides moved for summary judgment on Ross’s assertion of fair use.

On the issue of copyright infringement, Judge Bibas granted Thomson Reuters’ motion on the limited issue that Ross “copied at least portions of” Westlaw’s work.  However, the remaining issues of the copyright claim — the validity of Thomson Reuters’ copyright and the substantial similarity of Ross’s work — were denied summary judgment and will go to a jury.

On the issue of fair use, Ross contends that its use of Thomson Reuters’ materials, even if found to be copyright protected, was permissible.

The question of fair use protection for generative AI developers is significant because all generative AI requires the input of a vast amount of information to train its machine learning and develop its content.  Intellectual property law comes into play where the training materials — the “input” into the AI — are copyright protected.  When the input material is copyright protected, AI developers may seek to rely on the fair use doctrine to use copyright-protected works without permission from the copyright holder.

As discussed in the court’s opinion, whether the use of copyrighted material is fair depends on the balance of four factors — the purpose and character of the use, the nature of the copyrighted work, the amount and substantiality of the portion used in relation to the copyrighted work as a whole, and the effect of the use upon the potential market for the copyrighted work.  Courts tend to give the most weight to the first and fourth factors.

The first factor, the purpose and character of the use, looks to the commerciality and transformativeness of the use of the copyrighted work.  While Judge Bibas held that Ross’s use of Thomson Reuters’ materials was undoubtedly commercial in nature, which weighs against finding fair use, the court could not say as a matter of law whether Ross’ works were sufficiently transformative.  Each party offers a differing account of exactly how Ross used the Westlaw information — did Ross merely translate Westlaw’s headnotes into numerical data that would later be displayed by its AI search engine?  Or did it, as Ross contends, study Westlaw’s headnotes and opinion quotes only to analyze language patterns rather than replicate Westlaw’s protected expressions?

According to the court, the answers to these questions fall within the discretion of a jury. In this regard, the court noted that Ross’s use was “transformative intermediate copying if Ross’s AI only studied the language patterns in the headnotes to learn how to produce judicial opinion quotes.  But if Thomson Reuters is right that Ross used the untransformed text of its headnotes to get its AI to replicate and reproduce the creative drafting done by Westlaw’s attorney editors,” then Ross’s argument that its work was sufficiently transformative might fail.

As to the other three factors for fair use, the court similarly held that they could not be resolved on summary judgment because of remaining questions of fact.  However, the court noted that the second factor — the nature of Thomson Reuters’ copyrighted work — seemed to favor fair use.  Specifically, Westlaw’s Key Number system is a method of organization that “inherently involves significantly less creative or original expression” than traditionally protected materials, and the Headnotes are “akin to news reporting” that must be carefully separated from the unprotected underlying facts of the judicial opinions they synthesize. A jury trial in this case might yield the first judgment on issues related to generative AI, copyright, and fair use.  This case could have an impact not only on the AI and machine learning industry, but also the public interest as a whole while the world continues to adjust to the myriad new realities and resulting issues of first impression on the new AI frontier.

For more articles on AI copyright, visit the NLR Intellectual Property law section.

Chat with Caution: The Growing Data Privacy Compliance and Litigation Risk of Chatbots

In a new wave of privacy litigation, plaintiffs have recently filed dozens of class action lawsuits in state and federal courts, primarily in California, seeking damages for alleged “wiretapping” by companies with public-facing websites. The complaints assert a common theory: that website owners using chatbot functions to engage with customers are violating state wiretapping laws by recording chats and giving service providers access to them, which plaintiffs label “illegal eavesdropping.”

Chatbot wiretapping complaints seek substantial damages from defendants and assert new theories that would dramatically expand the application of state wiretapping laws to customer support functions on business websites.

Although there are compelling reasons why courts should decline to extend wiretapping liability to these contexts, early motions to dismiss have met mixed outcomes. As a result, businesses that use chatbot functions to support customers now face a high-risk litigation environment, with inconsistent court rulings to date, uncertain legal holdings ahead, significant statutory damages exposure, and a rapid uptick in plaintiff activity.

Strict State Wiretapping Laws

Massachusetts and California have some of the most restrictive wiretapping laws in the nation, requiring all parties to consent to a recording, in contrast to the one-party consent required under federal and many state laws. Those two states have been key battlegrounds for plaintiffs attempting to extend state privacy laws to website functions, partly because they provide for significant statutory damages per violation and an award of attorney’s fees.

Other states with wiretapping statutes requiring the consent of all parties include Delaware, Florida, Illinois, Maryland, Montana, Nevada, New Hampshire, Pennsylvania, and Washington. As in Massachusetts and California, litigants in Florida and Pennsylvania have started asserting wiretapping claims based on website functions.

Plaintiffs’ Efforts to Extend State Wiretapping Laws to Chatbot Functions

Chatbot litigation is a product of early favorable rulings in cases targeting other website technologies, refashioned to focus on chat functions. Chatbots allow users to direct inquiries to AI virtual assistants or human customer service representatives. Chatbot functions are often deployed using third-party vendor software, and when chat conversations are recorded, those vendors may be provided access to live recordings or transcripts.

This most recent wave of plaintiffs now claim that recording chat conversations and making them accessible to vendors violates state wiretapping laws, with liability for both the website operator and the vendor. However, there are several reasons why the application of wiretapping laws in this context is inappropriate, and defendants are asserting these legal arguments in early dispositive motion practice with mixed results.

What Businesses Can Do to Address Growing Chatbot Litigation Risk

Despite compelling legal arguments for why these suits should be stopped, businesses with website chat functions should exercise caution to avoid being targeted, as we expect to see chatbot wiretap claims to skyrocket. This litigation risk is present in all two-party consent states, but especially in Massachusetts and California. Companies should beware that they can be targeted in multiple states, even if they do not offer products or services directly to consumers.

In this environment, a review and update of your company’s website for data privacy compliance, including chatbot activities, is advisable to avoid expensive litigation. These measures include:

  • Incorporating clear disclosure language and robust affirmative consent procedures into the website’s chat functions, including specific notification in the function itself that the chatbot is recording and storing communications
  • Expanding website dispute resolution terms, including terms that could reduce the risk of class action litigation and mass arbitration
  • Updating the website’s privacy policy to accurately and clearly explain what data, if any, is recorded, stored, and transmitted to service providers through its chat functions, ideally in a dedicated “chat” section
  • Considering data minimization measures in connection with website chat functions
  • Evaluating third-party software vendors’ compliance history, including due diligence to ensure a complete understanding of how chatbot data is collected, transmitted, stored, and used, and whether the third party’s privacy policies are acceptable

Companies may also want to consider minimizing aspects of their chatbots that have a high annoyance factor – such as blinking “notifications” – to reduce the likelihood of attracting a suit. This list is not comprehensive, and businesses should ensure their legal teams are aware of their website functions and data collection practices.

For more articles on privacy, visit the NLR Communications, Media and Internet section.

FTC and DOJ Propose Significant Changes to US Merger Review Process

On 27 June 2023, the Federal Trade Commission (FTC) and the Department of Justice–Antitrust Division (DOJ) (collectively, the Agencies) announced sweeping proposed changes to the US-premerger notification filing process. The proposed changes mark the first significant overhaul of the federal premerger notification form since its original release in 1978 and would require parties to report

On 27 June 2023, the Federal Trade Commission (FTC) and the Department of Justice–Antitrust Division (DOJ) (collectively, the Agencies) announced sweeping proposed changes to the US-premerger notification filing process. The proposed changes mark the first significant overhaul of the federal premerger notification form since its original release in 1978 and would require parties to reportable transactions to collect and submit significantly more information and documentation as part of the premerger review process. If finalized, the proposed rule changes would likely delay deal timelines by months, requiring significantly more time and effort by the parties and their counsel in advance of submitting the required notification form.

In this alert, we:

  • Provide an overview of the current merger review process in the United States;
  • Describe the proposed new rules announced by the Agencies;
  • Explain the Agencies’ rationale for the new proposed rules;
  • Predict how the proposed new rules could impact parties’ premerger filing obligations, including deal timelines; and
  • Explain what companies should expect over the next several months.

BACKGROUND ON THE HSR MERGER REVIEW PROCESS

The Hart-Scott-Rodino Antitrust Improvements Act of 1976, as amended (the HSR Act or “HSR”) requires certain persons making acquisitions of assets, voting securities, and non-corporate interests (i.e., interests in partnerships and limited liability companies) to:

(a)    File premerger notifications with the FTC and DOJ; and

(b)    Wait until the expiration or termination of a waiting period (usually 30 days) before consummating the acquisition.

Most mergers and acquisitions valued in excess of USD$111.4 million fall under the HSR Act subject to size-of-party thresholds in certain cases. Additionally, there are several exemptions that may apply to an otherwise reportable transaction.

The FTC or the DOJ reviews the parties’ HSR filings during the waiting period to determine whether the transaction may substantially lessen competition in violation of the antitrust laws. If, at the end of the waiting period any concerns have not been placated, the reviewing agency may issue a Request for Additional Documents and Information (commonly referred to as a Second Request), a very broad subpoena-like document seeking documents, data, and interrogatory responses from the filers. This tolls the waiting period until both parties substantially comply with the Second Request. The reviewing agency then has an additional 30-day period to decide whether to challenge the transaction in court.

WHAT ARE THE PROPOSED CHANGES?

On 27 June 2023, the FTC and DOJ announced a number of significant changes to the HSR notification form and filing process, the first such overhaul in almost 45 years. The Agencies released the proposed changes and rationale for the same in a 133-page Notice of Proposed Rulemaking (Notice) that will be published in the Federal Register later this week. While antitrust practitioners are still digesting the full extent of all of the proposed changes, it is clear that they would require parties to submit significantly more information and documentation to the Agencies as part of their HSR notification form. The most notable additional information and documentation includes:

  • Submission of additional deal documents, including draft agreements or term sheets (as opposed to just the preliminary agreement), where a definitive transaction agreement has not yet been executed; draft versions of all deal documents (as opposed to just the final versions); documents created by or for the deal team lead(s) (as opposed to just officers and directors); and verbatim translations of all foreign language documents.
  • Details about acquisitions during the previous 10 years.
  • Identification of and information about all officers, directors, and board observers of all entities within the acquiring person, including the identification of other entities these individuals currently serve, or within the two years prior to filing had served, as an officer, director, or board observer.
  • Identification of and information about all creditors and entities that hold non-voting securities, options, or warrants totaling 10% or more.
  • Disclosure of subsidies (e.g., grants and loans), by certain foreign governments, including North Korea, China, Russia, and Iran.
  • Narrative description of the strategic rationale for the transaction (including projected revenue streams), a diagram of the deal structure, and a timeline and narrative of the conditions for closing.
  • Identification and narrative describing horizontal overlaps, both current and planned.
  • Identification and narrative describing supply agreements/relationships.
  • Identification and narrative describing labor markets, as well as submission of certain data on the firms’ workforce, including workforce categories, geographic information on employees, and details on labor and workplace safety violations.
  • Identification of certain defense or intelligence contracts.
  • Identification of foreign jurisdictions reviewing the deal.

WHY ARE THESE CHANGES BEING PROPOSED?

In its press release announcing the proposed new rules, the FTC stated that “[t]he proposed changes to the HSR Form and instructions would enable the Agencies to more effectively and efficiently screen transactions for potential competition issues within the initial waiting period, which is typically 30 days.”The FTC further explained:

Over the past several decades, transactions (subject to HSR filing requirements) have become increasingly complex, with the rise of new investment vehicles and changes in corporate acquisition strategies, along with increasing concerns that antitrust review has not sufficiently addressed concerns about transactions between firms that compete in non-horizontal ways, the impact of corporate consolidation on American workers, and growth in the technology and digital platform economies. When the Agencies experienced a surge in HSR filings that more than doubled filings from 2020 to 2021, it became impossible to ignore the changes to the transaction landscape and how much more complicated it has become for agency staff to conduct an initial review of a transaction’s competitive impact. The volume of filings at that time also highlighted the significant limitations of the current HSR Form in understanding a transaction’s competitive impact.2

Finally, the FTC also cited certain Congressional concerns and the Merger Fee Filing Modernization Act of 2022, stating that the “proposed changes also address Congressional concerns that subsidies from foreign entities of concern can distort the competitive process or otherwise change the business strategies of a subsidized firm in ways that undermine competition following an acquisition. Under the Merger Filing Fee Modernization Act of 2022, the agencies are required to collect information on subsidies received from certain foreign governments or entities that are strategic or economic threats to the United States.”

HOW WILL THESE CHANGES POTENTIALLY IMPACT PARTIES’ HSR FILINGS?

The proposed changes, as currently drafted, would require significantly more time and effort by the parties and their counsel to prepare the parties’ respective HSR notification forms. For example, the proposed new rules require the identification, collection, and submission of more deal documents and strategic documents; significantly more information about the parties, their officers, directors and board observers, minority investments, and financial interests; and narrative analyses and descriptions of horizontal and non-horizontal relationships, markets, and competition. Gathering, analyzing, and synthesizing this information into narrative form will require significantly more time and resources from both the parties and their counsel to comply.

Under the current filing rules, it typically takes the merging parties about seven to ten days to collect the information needed for and to complete the HSR notification form. Under the proposed new rules, the time to gather such information and complete an HSR notification form could be expanded by multiple months.

WHAT IS NEXT?

The Notice will be published in the Federal Register later this week. The public will then have 60 days from the date of publication to submit comments. Following the comment period, the Agencies will review and consider the comments and then publish a final version of the new rules. The new rules will not go into effect until after the Agencies publish the final version of the new rules. This process will likely take several months to complete, and the new rules–or some variation of them–will not come into effect until that time.

While the final form of the proposed rules are not likely to take effect for several months, the Agencies’ sweeping proposed changes to the notification form and filing process are in line with the type of information that the Agencies have been increasingly requesting from parties during the merger review process. Accordingly, parties required to submit HSR filings over the next several months should be prepared to receive similar requests from the Agencies, either on a voluntary basis (e.g., during the initial 30-day waiting period) or through issuance of a Second Request, and they should build into their deal timeline (either pre- or post-signing) sufficient time to comply with these requests.

 

“FTC and DOJ Propose Changes to HSR Form for More Effective, Efficient Merger Review,” FTC Press Release, June 27, 2023, available at FTC and DOJ Propose Changes to HSR Form for More Effective, Efficient Merger Review | Federal Trade Commission.  

“Q and A on the Notice of Proposed Rulemaking for the HSR Filing Process,” FTC Proposed Text of Federal Register Publication, available at 16 CFR Parts 801 and 803: Premerger Notification; Reporting and Waiting Period Requirements | Federal Trade Commission (ftc.gov).

Copyright 2023 K & L Gates

European Commission Aims to Tackle Greenwashing in Latest Proposal

On March 22, the European Commission unveiled a proposal, the Green Claims Directive (Proposal), aimed at combating greenwashing and misleading environmental claims. By virtue of the Proposal, the EC is attempting to implement measures designed to provide “reliable, comparable and verifiable information” to consumers, with the overall high-level goal to create a level playing field in the EU, wherein companies that make a genuine effort to improve their environmental sustainability can be easily recognized and rewarded by consumers. The Proposal follows a 2020 sweep that found nearly half of environmental claims examined in the EU may be false or deceptive. Following the ordinary legislative procedure, the Proposal will now be subject to the approval of the European Parliament and the Council. There is no set date for entry into force at this time.

The Proposal complements a March 2022 proposal to amend the Consumer Rights Directive to provide consumers with information on products’ durability and repairability, as well as to amend the Unfair Commercial Practices Directive by, among other things, banning “generic, vague environmental claims” and “displaying a voluntary sustainability label which was not based on a third-party verification scheme or established by public authorities.” The Proposal builds on these measures to provide “more specific requirements on unregulated claims, be it for specific product groups, specific sectors or for specific environmental impacts or aspects.” It would require companies that make “green claims to respect minimum standards on how they substantiate and communicate those claims.” Businesses based outside the EU that make environmental claims directed at EU consumers will also have to respect the requirements set out in the Proposal. The criteria target explicit claims, such as “T-shirt made of recycled plastic bottles” and “packaging made of 30% recycled plastic.”

Pursuant to Article 3 of the Proposal, “environmental claims shall be based on an assessment that meets the selected minimum criteria to prevent claims from being misleading,” including, among other things, that the claim “relies on recognised scientific evidence and state of the art technical knowledge,” considers “all significant aspects and impacts to assess the performance,” demonstrates whether the claim is accurate for the whole product or only parts of it, provides information on whether the product performs better than “common practice,” identifies any negative impacts resulting from positive product achievements, and reports greenhouse gas offsets.

Article 4 of the Proposal outlines requirements for comparative claims related to environmental impacts, including disclosure of equivalent data for assessments, use of consistent assumptions for comparisons and use of data sourced in an equivalent manner. The level of substantiation needed will vary based on the type of claim, but all assessments should consider the product’s life-cycle to identify relevant impacts.

Pursuant to Article 10, all environmental claims and labels must be verified and certified by a third-party verifier before being used in commercial communications. An officially accredited body will carry out the verification process and issue a certificate of conformity, which will be recognized across the EU and shared among Member States via the Internal Market Information System. The verifier is required to be an officially accredited, independent body with the necessary expertise, equipment, and infrastructure to carry out the verifications and maintain professional secrecy.

The Proposal is part of a broader trend of governmental regulators, self-regulatory organizations, and standard setters across industries adopting a more formalized approach toward greenwashing. For example, as we recently reported, the UK’s Advertising Standards Authority (ASA) published rules on making carbon neutral and net-zero claims. Instances of enforcement actions over greenwashing allegations have also been on the rise. The Securities and Exchange Board of India recently launched a consultation paper seeking public comment on rules to prevent greenwashing by ESG investment funds, and the European Council and the European Parliament reached an agreement regarding European Green Bonds Standards aimed at, among other things, avoiding greenwashing.

© Copyright 2023 Cadwalader, Wickersham & Taft LLP

Clop Claims Zero-Day Attacks Against 130 Organizations

Russia-linked ransomware gang Clop has claimed that it has attacked over 130 organizations since late January, using a zero-day vulnerability in the GoAnywhere MFT secure file transfer tool, and was successful in stealing data from those organizations. The vulnerability is CVE-2023-0669, which allows attackers to execute remote code execution.

The manufacturer of GoAnywhere MFT notified customers of the vulnerability on February 1, 2023, and issued a patch for the vulnerability on February 7, 2023.

HC3 issued an alert on February 22, 2023, warning the health care sector about Clop targeting healthcare organizations and recommended:

  • Educate and train staff to reduce the risk of social engineering attacks via email and network access.
  • Assess enterprise risk against all potential vulnerabilities and prioritize implementing the security plan with the necessary budget, staff, and tools.
  • Develop a cybersecurity roadmap that everyone in the healthcare organization understands.

Security professionals are recommending that information technology professionals update machines to the latest GoAnywhere version and “stop exposing port 8000 (the internet location of the GoAnywhere MFT admin panel).”

Copyright © 2023 Robinson & Cole LLP. All rights reserved.

The EU’s New Green Claims Directive – It’s Not Easy Being Green

Highlights

  • On March 22, 2023, the European Commission proposed the Green Claims Directive, which is intended to make green claims reliable, comparable and verifiable across the EU and protect consumers from greenwashing
  • Adding to the momentum generated by other EU green initiatives, this directive could be the catalyst that also spurs the U.S. to approve stronger regulatory enforcement mechanisms to crackdown on greenwashing
  • This proposed directive overlaps the FTC’s request for comments on its Green Guides, including whether the agency should initiate a rulemaking to establish enforceable requirements related to unfair and deceptive environmental claims. The deadline for comments has been extended to April 24, 2023

The European Commission (EC) proposed the Green Claims Directive (GCD) on March 22, 2023, to crack down on greenwashing and prevent businesses from misleading customers about the environmental characteristics of their products and services. This action was in response, at least in part, to a 2020 commission study that found more than 50 percent of green labels made environmental claims that were “vague, misleading or unfounded,” and 40 percent of these claims were “unsubstantiated.”

 

This definitive action by the European Union (EU) comes at a time when the U.S. is also considering options to curb greenwashing and could inspire the U.S. to implement stronger regulatory enforcement mechanisms, including promulgation of new enforceable rules by the Federal Trade Commission (FTC) defining and prohibiting unfair and deceptive environmental claims.

According to the EC, under this proposal, consumers “will have more clarity, stronger reassurance that when something is sold as green, it actually is green, and better quality information to choose environment-friendly products and services.”

Scope of the Green Claims Directive

The EC’s objectives in the proposed GCD are to:

  • Make green claims reliable, comparable and verifiable across the EU
  • Protect consumers from greenwashing
  • Contribute to creating a circular and green EU economy by enabling consumers to make informed purchasing decisions
  • Help establish a level playing field when it comes to environmental performance of products

The related proposal for a directive on empowering consumers for the green transition and annex, referenced in the proposed GCD, defines the green claims to be regulated as follows:

“any message or representation, which is not mandatory under Union law or national law, including text, pictorial, graphic or symbolic representation, in any form, including labels, brand names, company names or product names, in the context of a commercial communication, which states or implies that a product or trader has a positive or no impact on the environment or is less damaging to the environment than other products or traders, respectively, or has improved their impact over time.”

The GCD provides minimum requirements for valid, comparable and verifiable information about the environmental impacts of products that make green claims. The proposal sets clear criteria for companies to prove their environmental claims: “As part of the scientific analysis, companies will identify the environmental impacts that are actually relevant to their product, as well as identifying any possible trade-offs to give a full and accurate picture.” Businesses will be required to provide consumers information on the green claim, either with the product or online. The new rule will require verification by independent auditors before claims can be made and put on the market.

The GCD will also regulate environmental labels. The GCD is proposing to establish standard criteria for the more than 230 voluntary sustainability labels used across the EU, which are currently “subject to different levels of robustness, supervision and transparency.” The GCD will require environmental labels to be reliable, transparent, independently verified and regularly reviewed. Under the new proposal, adding an environmental label on products is still voluntary. The EU’s official EU Ecolabel is exempt from the new rules since it already adheres to a third-party verification standard.

Companies based outside the EU that make green claims or utilize environmental labels that target the consumers of the 27 member states also would be required to comply with the GCD. It will be up to member states to set up the substantiation process for products and labels’ green claims using independent and accredited auditors. The GCD has established the following process criteria:

  • Claims must be substantiated with scientific evidence that is widely recognised, identifying the relevant environmental impacts and any trade-offs between them
  • If products or organisations are compared with other products and organisations, these comparisons must be fair and based on equivalent information and data
  • Claims or labels that use aggregate scoring of the product’s overall environmental impact on, for example, biodiversity, climate, water consumption, soil, etc., shall not be permitted, unless set in EU rules
  • Environmental labelling schemes should be solid and reliable, and their proliferation must be controlled. EU level schemes should be encouraged, new public schemes, unless developed at EU level, will not be allowed, and new private schemes are only allowed if they can show higher environmental ambition than existing ones and get a pre-approval
  • Environmental labels must be transparent, verified by a third party, and regularly reviewed

Enforcement of the GCD will take place at the member state level, subject to the proviso in the GCD that “penalties must be ‘effective, proportionate and dissuasive.’” Penalties for violation range from fines to confiscation of revenues and temporary exclusion from public procurement processes and public funding. The directive requires that consumers should be able to bring an action as well.

The EC’s intent is for the GCD to work with the Directive on Empowering the Consumers for the Green Transition, which encourages sustainable consumption by providing understandable information about the environmental impact of products, and identifying the types of claims that are deemed unfair commercial practices. Together these new rules are intended to provide a clear regime for environmental claims and labels. According to the EC, the adoption of this proposed legislation will not only protect consumers and the environment but also give a competitive edge to companies committed to increasing their environmental sustainability.

Initial Public Reaction to the GCD and Next Steps

While some organizations, such as the International Chamber of Commerce, offered support, several interest groups quickly issued public critiques of the proposed GCD. The Sustainable Apparel Coalition asserted that: “The Directive does not mandate a standardized and clearly defined framework based on scientific foundations and fails to provide the legal certainty for companies and clarity to consumers.”

ECOS lamented that “After months of intense lobbying, what could have been legislation contributing to providing reliable environmental information to consumers was substantially watered down,” and added that “In order for claims to be robust and comparable, harmonised methodologies at the EU level will be crucial.” Carbon Market Watch was disappointed that “The draft directive fails to outlaw vague and disingenuous terms like ‘carbon neutrality’, which are a favoured marketing strategy for companies seeking to give their image a green makeover while continuing to pollute with impunity.”

The EC’s proposal will now go to the European Parliament and Council for consideration. This process usually takes about 18 months, during which there will be a public consultation process that will solicit comments, and amendments may be introduced. If the GCD is approved, each of the 27 member states will have 18 months after entry of the GCD to adopt national laws, and those laws will become effective six months after that. As a result, there is a reasonably good prospect that there will be variants in the final laws enacted.

Will the GCD Influence the U.S.’s Approach to Regulation of Greenwashing?

The timing and scope of the GCD is of no small interest in the U.S., where regulation of greenwashing has been ramping up as well. In May 2022, the Securities and Exchange Commission (SEC) issued the proposed Names Rule and ESG Disclosure Rule targeting greenwashing in the naming and purpose of claimed ESG funds. The SEC is expected to take final action on the Names Rule in April 2023.

Additionally, as part of a review process that occurs every 10 years, the FTC is receiving comments on its Green Guides for the Use of Environmental Claims, which also target greenwashing. However, the Green Guides are just that – guides that do not currently have the force of law that are used to help interpret what is “unfair and deceptive.”

It is particularly noteworthy that the FTC has asked the public to comment, for the first time, on whether the agency should initiate a rulemaking under the FTC Act to establish independently enforceable requirements related to unfair and deceptive environmental claims. If the FTC promulgates such a rule, it will have new enforcement authority to impose substantial penalties.

The deadline for comments on the Green Guides was recently extended to April 24, 2023. It is anticipated that there will be a substantial number of comments and it will take some time for the FTC to digest them. It will be interesting to watch the process unfold as the GCD moves toward finalization and the FTC decides whether to commence rulemaking in connection with its Green Guide updates. Once again there is a reasonable prospect that the European initiatives and momentum on green matters, including the GCD, could be a catalyst for the US to step up as well – in this case to implement stronger regulatory enforcement mechanisms to crackdown on greenwashing.

© 2023 BARNES & THORNBURG LLP

Consumer Fraud PFAS Lawsuits Update: Two Cases Dismissed

On several instanceswe have written regarding consumer fraud PFAS class action lawsuits filed in several states. The number of product types targeted for these lawsuits are growing and diverse in terms of the industries targeted. While there has been at least one significant settlement in these lawsuits to date, recently two of the lawsuits that we previously reported on related to PFAS consumer fraud allegations were dismissed by separate courts.

While it is too early to say that these dismissals are a preview of a coming trend in the litigation, the rulings at least provide companies with assurance that there are defenses available in these cases. Nevertheless, with the number of consumer fraud lawsuits likely to continue increasing for the time being, consumer goods industries, insurers, and investment companies interested in the consumer goods vertical must pay careful attention to these lawsuits.

Consumer Fraud PFAS Lawsuits – Overview

The consumer fraud PFAS lawsuits filed to date follow a very similar pattern: various plaintiffs bringing suit on behalf of a proposed class allege that companies market consumer goods as safe, healthy, environmentally friendly, etc., or that the companies themselves market their corporate practices as such, yet it is allegedly discovered that certain products marketed with these buzzwords contain PFAS. The lawsuits allege that since certain PFAS may be harmful to human health and PFAS are biopersistent (and therefore environmentally unfriendly), the companies making the good engaged in fraud against consumers to entice them to purchase the products in question.

In the Complaints, plaintiffs typically allege the following counts:

  • Violation of state consumer protection laws and the federal Magnuson-Moss Warranty Act
  • Violations of various state consumer protection laws
  • Breach of warranty
  • Fraud
  • Constructive fraud
  • Unjust enrichment

The plaintiffs seek certification of nationwide class action lawsuits, with a subclass defined as consumers in the state in which the lawsuits are filed. In addition, the lawsuits seeks damages, fees, costs, and a jury trial. Representative industries and cases that have recently been filed include:

  • Cosmetics industry:
    • Brown v. Cover Girl, New York (April 1, 2022)
    • Anderson v. Almay, New York (April 1, 2022)
    • Rebecca Vega v. L’Oreal, New Jersey (April 8, 2022)
    • Spindel v. Burt’s Bees, California (March 25, 2022)
    • Hicks and Vargas v. L’Oreal, New York (March 9, 2022)
    • Davenport v. L’Oreal, California (February 22, 2022)
  • Food packaging industry:
    • Richburg v. Conagra Brands, Illinois (May 6, 2022)
    • Ruiz v. Conagra Brands, Illinois (May 6, 2022)
    • Hamman v. Cava Group, California (April 27, 2022)
    • Azman Hussain v. Burger King, California (April 11, 2022)
    • Little v. NatureStar, California (April 8, 2022)
    • Larry Clark v. McDonald’s, Illinois (March 28, 2022)
  • Food and drink products:
    • Bedson v. Biosteel, New York (January 27, 2023)
    • Lorenz v. Coca-Cola, New York (December 28, 2022)
    • Toribio v. Kraft Heinz, Illinois (November 29, 2022)
  • Apparel products:
    • Krakauer v. REI, Washington (October 28, 2022)
  • Hygiene products:
    • Esquibel v. Colgate-Palmolive Co., New York (January 27, 2023)
    • Dalewitz v. Proctor & Gamble, New York (August 26, 2022)
  • Feminine hygiene products:
    • Gemma Rivera v. Knix Wear Inc., California (April 4, 2022)
    • Blenis v. Thinx, Inc., Massachusetts (June 18, 2021)
    • Destini Canan v. Thinx Inc., California (November 12, 2020)

Recent Rulings In Consumer Fraud PFAS Cases

In California, the Yeraldinne Solis v. CoverGirl Cosmetics et al. case made allegations that cosmetics were marketed as safe and sustainable, yet were found to contain PFAS. The defendants in the lawsuit filed a Motion to Dismiss, arguing in relevant part that the plaintiff had no standing to file the lawsuit because she did not sufficiently allege that she suffered any economic harm from purchasing the product. The plaintiff put forth two theories to counter this argument: (1) the “benefit of the bargain” theory, under which the plaintiff alleged that she bargained for a product that was “safe”, but received the opposite. The court dismissed this argument because the product packaging did not market the product as safe, and the ingredient list explicitly named the type of PFAS found in testing; and (2) an overpayment theory, under which plaintiff alleged that if she knew the product contained PFAS, she would not have paid as much for it as she did. The Court dismissed this argument because the product packaging specifically listed the type of PFAS at issue in the case.

In Illinois, the Richburg v. Conagra Brands, Inc. alleged that popcorn packaging was marketed as containing “only real ingredients” and ingredients from “natural sources”, yet the popcorn contained PFAS (likely from the packaging itself), which was allegedly false and misleading to consumers. The defendant moved to dismiss the lawsuit on several grounds and the Court found in defendant’s favor on one important ground. The Court held that the statements on the popcorn packaging would not mislead an ordinary and reasonable consumer because a consumer would understand “ingredients” to mean those items that are required to be disclosed by the FDA and not materials that may have migrated to the food from the product packaging. In fact, the Court ruled that the FDA “exempts substances migrating to food from equipment or packaging;” and those “do not need to be included in the ingredients list.”  The defendant argued that reasonable consumers would not consider PFAS to be an “ingredient” under this regime.  In other words, whether or not PFAS migrated into the popcorn, the representations that the popcorn contained “only real ingredients” and “100% ingredients from natural sources” were “correct as a matter of law.” The court dismissed plaintiffs claims on this basis.

Conclusion

Several major companies now find themselves embroiled in litigation focused on PFAS false advertising, consumer protection violations, and deceptive statements made in marketing and ESG reports. The lawsuits may well serve as test cases for plaintiffs’ bar to determine whether similar lawsuits will be successful in any (or all) of the fifty states in this country. Companies must consider the possibility of needing to defend lawsuits involving plaintiffs in all fifty states for products that contain PFAS. It should be noted that these lawsuits would only touch on the marketing, advertising, ESG reporting, and consumer protection type of issues. Separate products lawsuits could follow that take direct aim at obtaining damages for personal injury for plaintiffs from consumer products. In addition, environmental pollution lawsuits could seek damage for diminution of property value, cleanup costs, and PFAS filtration systems if drinking water cleanup is required.

While the above rulings are encouraging for companies facing consumer fraud PFAS lawsuits, it is far too early to tell if the trend will continue nationally.  Different courts apply legal standards differently and these cases are very fact specific, which could lead to differing results.

It is of the utmost importance that businesses along the whole supply chain in the consumer products industry evaluate their PFAS risk. Public health and environmental groups urge legislators to regulate PFAS at an ever-increasing pace. Similarly, state level EPA enforcement action is increasing at a several-fold rate every year. Now, the first wave of lawsuits take direct aim at the consumer products industry. Companies that did not manufacture PFAS, but merely utilized PFAS in their manufacturing processes, are therefore becoming targets of costly enforcement actions at rates that continue to multiply year over year. Lawsuits are also filed monthly by citizens or municipalities against companies that are increasingly not PFAS chemical manufacturers.

©2023 CMBG3 Law, LLC. All rights reserved.

Inflation’s Effect on Taxes – The Good and the Bad

Many federal tax provisions are adjusted for inflation annually, but not all. Rising inflation may result in lower tax bills for many taxpayers in 2023. Unfortunately, the impacts of inflation on taxpayers will not lower their 2022 tax bills even though inflation is at the highest level in the past 40 years.

The standard deduction is indexed for inflation. In 2023, for married couples filing joint tax returns, the standard deduction increased by $1,800 to $27,700; and for single taxpayers the standard deduction increased by $900 to $13,850.

The tax rates for individual tax filers have not changed (with the highest tax rate remaining at 37%), but the income levels have increased between the brackets. For example, in 2023, the 32% tax bracket starts at $364,200 for married couples filing jointly (up from $340,100 in 2022); and the 35% bracket for married couples filing jointly starts at $462,500 (up from $331,900 in 2022).

Estates of decedents who die in 2023 will have an estate tax exemption of $12,920,000 (up from $12,060,000 in 2022). The gift tax exclusions also increased to the same amounts and the annual gift exclusion increased to $17,000 per donee, which allows a married couple to gift $34,000 using their annual exclusion with no limit on the number of donees.

Social security recipients will enjoy an 8.7% increase in their monthly benefits in 2023 compared to 2022.

Other increases, as a result of rising inflation, include higher maximum contributions to retirement plans, health savings accounts and flexible spending accounts.

Inflation will impact taxpayers, employees and employers negatively as well. Employees, employers and self-employed individuals will be subject to social security taxes on earnings of $160,200 (up from $147,000 in 2022).

The limitation on itemized deduction for state and local tax has not increased, although state and local taxes have generally increased and the personal exemption continues to remain at zero. Finally, there has been no reduction in the long-term capital gains tax rate or increase in the deduction for capital losses which remains limited to $3,000 per year in excess of capital gains.

For more tax legal news, click here to visit the National Law Review.

© 2023 Chuhak & Tecson P.C.